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AN APPLICATION OF FAILURE FLOW 
ANALYSIS TO A GSFC SPACECRAFT PROJECT 


Robert E. Heuser 
Test and Evaluation Division 


SUMMARY 

This report discusses the use of failure flow anal- 
ysis to evaluate the test program of the Interplanetary 
Monitoring Platform I (IMP-I) spacecraft. The flow 
of defects from point of origin to point of detection is 
mapped. The effectiveness of the various screen sys- 
tems is calculated, and the reasons for escape from 
the screens is presented. The distribution of causes 
of defects is examined, and the criticality of the de- 
fects is determined. The flight results are compared 
to the test performance. 

The bench test screen and subsystem test screen 
are both only about 50% effective, while the system test 
is 92% effective. Design is a major cause of defects, 
but the number of parts defects - in test and in space - 
is significant. About half of the defects detected in 
test would have resulted in a much degraded sub- 
system performance if they occurred in space, but 
few defects would have affected the entire mission. The 
flight results seem to show the ability of a protoflight 
test program to detect fabrication caused defects. 
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AN APPLICATION OF FAILURE FLOW 
ANALYSIS TO A GSFC SPACECRAFT PROJECT 


INTRODUCTION 

Failure flow analysis was developed by the General Electric Company and 
was applied to the RAE-A system test program in 1969 through a contract moni- 
tored by the Past Experience and Performance Program of the Test and Evalua- 
tion Division (ref. 1). This method of analyzing a test program showed promise 
for analyzing other GSFC test programs so a decision was made to do a failure 
flow analysis as an in-house effort. 

Description of Failure Flow Analysis 


Failure flow analysis depends on an accurate malfunction reporting system 
as its major source of data. The data is analyzed to provide information on such 
things as the criticality of defects, where the defect originated, what the cause 
of the defect was, why the defect escaped certain test screens, and others. In 
this way the defect can be tracked through a program from source to detection 
and diversion, and hence, the analogy with defects flowing through a system of 
screens. 

There are two major facets to failure flow analysis. First, it critically ex- 
amines a test program and indicates which areas need improving. Second, it 
points out the sources of defects, which could lead to the elimination of some 
sources and the diminution of others. 

The Use of IMP-I for This Study 

IMP-I was chosen as the program for the application of failure flow analysis. 
Although this study was undertaken primarily to evaluate the practicability of 
using failure flow analysis on a large scale basis, the IMP-I test program pro- 
vided an opportunity to collect some data that would be useful regardless of fail- 
ure flow analysis. More detailed reasons why IMP-I was used are provided in 
the next three paragraphs. 

1. IMP-I was an in-house program. This meant that most of the testing 
was done at GSFC, and individual tests could be observed if desired. 
Also, many of the designers and fabricators of the hardware were 
available when questions arose on the nature or consequences of a 
particular malfunction. 
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2. TMP-T had an extensive and well documented subsys’.em test program. 
Past examinations of system test programs have been hampered by a 
lack of information on performance prior to system testing. 

3. IMP-I was a protoflight spacecraft. Since the protoflight concept is be- 
coming popular, and IMP-I was the most complicated protoflight space- 
craft ever built at GSFC, then the IMP-I test program could provide 
valuable information on the strengths and weaknesses of the protoflight 
concent. 

Definition of Terms 


There are a number of terms that are used in failure flow analysis that need 
to be defined here. 

1 . Definition of Defect - the term defect encompasses the standard connotation 
of manufacturing flaws, but also includes any imperfection in the speci- 
fications, drawings, software, or hardware in a spacecraft program. In 
this report, two types of defects - systematic and non-sjstematic - are 
considered. Defects which can occur with regularity on all production 
units are described as "systematic. " Defects which occur only hy 
chance on isolated production units are described as "non-systematic. " 

2. Definition of Malfunction - defects are visible only when they manifest 
themselves through the occurrence of an anomalous condition in the 
program. Such anomalous conditions arc normally termed "malfunc- 
tion." Such terms as failure, anomaly, and problem are all included 
in "malfunction. " 

3. Definition of Protection - as used in failure flow analysis, protection 
is any hardware or procedure that is used to overcome the effects of a 
malfunction. For example, redundancy is a common type of hardware 
protection, and the ability to override an automatic operation with a 
ground command is a type of procedural protection. 

4. Definition of Criticality - the "criticality" of a defect is determined 
from the effect a malfunction would have on the operation of the sub- 
system, and also the effect of the malfunctioning subsystem on the mis- 
sion objectives. This report considers four levels of criticality - 
catastrophic, major degrading , minor degrading, and negligible. When 
the effects of protection, such as redundancy, are included, there are 
four ways of looking at the criticality of each defect: (1) subsystem 
before protection; (2) subsystem after protection; (3) mission before 
protection; and (4) mission after protection. 
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5. Definition of Screen - a screen is any activity whose purpose is the de- 
tection and diversion of defects. Detection is the acknowledgement that 
a defect exists and the identification of the defect. Diversion is the re- 
moval of the defect from the system. Defects may escape a screen, 
and thus remain in the program (or in the flow), by either escaping de- 
tection or by escaping diversion. 

6. Definition of Card - a card is the smallest assembly of a subsystem or 
experiment. It is usually a trapezoidally shaped metal box that contains 
numerous piece parts, has its own connectors, and is potted as a unit. 
Some experiments contained only one card, while others used three or 
more. During bench test and subsystem test each card in an experi- 
ment or subsystem was often tested separately, rather than the whole 
subsystem or experiment. 

7. Definition of Ineligible - a defect is ineligible for detection by a screen 
when the defect is of such a nature that the screen would not normally 
be expected to detect the defect (e.g. , a defect that could only be found 
in thermal -vacuum would not be eligible for the vibration test screen). 
Ineligibility also applied to defects that were not in the flow yet, were 
not presented to the screen, were time dependent failure processes, 
were due to some variability 7 in the hardware, or were not presented to 
the screen at a high enough level of assembly. (An example of a time 
dependent defect would be a void that requires a month to outgas to the 
point where the pressure is in critical region for voltage breakdown. 
This w 7 ould be ineligible for the mermal-vacuum test screen, since the 
test only lasts two w'eeks . ) 

8. Definition of Inadequate - a screen is inadequate if it does not detect a 
defect that it should detect. 

Structure of Failure Flow Ana ly s is 

Failure flow analysis divides the test program into a series of screens. The 
defects are represented as "flowing" through the screen system with each screen 
acting like a sieve for particular kinds of defects. In the analysis each screen 
is considered separately, and then groups of screens are considered as an 
aggregate. 

The screen system for IMP-I is presented in Figure 1. This screen system 
is shown divided into four separate groups - bench test, subsystem Lest, system 
test, and orbit. Individual screens in each group were examined, and then each 
group was considered as an aggregate. The next section of this report will deal 
with the bench test screen, and succeeding sections will be concerned with sub- 
system test screens, system test screens, space performance, and conclusions. 


o 

O 



FINAl/ETR 


VIBRATION 


REINTEGRATION 


SHORT THERMAL- VACUUM 


SHORT VACUUM 1 & 2 


SO' ar SIMULATION 


THFRMAI-VAriJUM 


reintegratioh/emi 


SPIN DEPLOY 


VIBRATION 


reintegration 


ACS DEPLOYMENT 


MASS PROPERTIES 


TEMPERATURE 


SUN SPIN/ MAGNETIC ! 


INTEGRATION 

I 


T HERMAL- VACUUM 


VIBRATION 


EMI/ MAGNETIC 


BENCH TEST 


Figure 1 , iMP-i screen System 




















BENCH TEST SCREEN 


Description of the Bench Test Screen 


The bench test screen is shown in Figure 2. Any testing that is done sub- 
sequent to fabrication but prior to formal environmental Lest is included in this 



Figure 2. Bench Test Screen 


screen. This is the screen where the initial problems are worked out of the 
hardware. It could include anything from ambient testing to testing in a design- 
er's own temperature or thermal -vacuum chamber. These tests can be thought 
of as developmental tests. For this reason, many defects found at this stage 
are not reported as malfunctions , although a few are reported , so that the cx 
tent of activity during the bench test screen is only partial!}' known. The amount 
of testing done during this screen depends on the practice of each individual 
designer. The significance of the numbers is given below under Performance. . . 

Ori o reason for considering the bench test as a sr»r ,a#ir * ’ ? tha.t a. number of 
defects that are detected by a screen further downstream in the test program 
could have been found by the bench test screen. In failure flow terminology , 
bench test is the most eligible screen for a number of defects found later in the 
test program. If the reasons for escape from the bench test screen can be de- 
termined, then the bench test screen could possibly be made more effective, 
and the loading on the screens further downstream could be reduced. 

Performance of the Bench Test Screen 

Every defect, with the exception of those generated during the test program, 
had to pass through the bench test screen. Of the 125 malfunctions reported in 
malfunction reports throughout the program, 17 were detected and diverted dur- 
ing bench test. As was mentioned earlier, however, not all malfunctions occurring 




during bench test are reported. The difference between the 125 malfunction re- 
ports and the 103 defects entering bench test is that 22 defects did not go through 
the bench test screen. 

Reasons for Escape from Bench Test Screen 

The reasons for escape from the bench test screen are given in Figure 3. The 
largest percentage is shown to be in the "not practical" category. Figure 4 
combines the various categories of Figure 3 into three basic categories. The 
first category includes those that were not likely to be found during bench test. 
The bench test screen is ineligible to detect these defects. The second category 
includes those defects that should have been detected but were not. These are 



INEUGiBLE INADEQUATE 


Figure 3. Reasons fui Escape from Dench Test Screen 
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Figure 4. Diversions and General Reasons for Escape from 
Bench Tesf Screen 


the true escapes, and generally speaking the screen was inadequate to detect 
them. The third category includes the defects that were detected and diverted. 
Figure 4 shows the bench test screen to be less than 50% effective. A screen 
effectiveness is calculated by dividing the number of defects eligible for detec- 
tion in a screen into the number of defects that actually were detected. Because 
of the number of malfunctions that were unreported, not much confidence can be 
placed in the calculated effectiveness of the bench test screen. 

Criticality of defects F cund in Bench Test Scree n 

As mentioned previously, there are four criticality categories. Category 1, 
catastrophic, is a 30 percent to 100 percent loss of operation. Category 2, 
major degrading, is a ou percent tc ”0 percent loss of operation. Category 3, 
minor degrading, is a 10 percent to 50 percent loss of operation. Category 4, 
negligible, is a less than 10 percent loss of operation. Table 1 shows tiie sub- 
system and mission criticalities before and after protection of the deieets de- 
tected in the bench test screen. The numbers in the table are numbers of 
defects. 
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Table 1 


Bench Test Screen: Criticality vs Protection 



Criticality 

1 

2 

3 

4 

Subsystem Before Protection 

12 

3 

1 

1 

Subsystem After Protection 

10 

3 

1 

3 

Mission Before Protection 

2 

2 

1 

12 

Mission After Protection 

i— 

n 

L. 

1 

1 

13 


Note 1: Criticaiity 

t 90% - 1 00% loss 3 1 0% - 50% loss 

2 50% - 90% loss 4 0% - 10% loss 

Note 2: Numbers in table are number of defects. 


Twelve uf the seventeen defects were catastrophic to the subsystem before 
protection , anu protection does very little to reduce the criticality. On the other 
hand only about one-eighth of the defects are catastrophic to the mission, but, 
again, there is practically no protection. If these patterns were to persist through- 
out the screen system , then a space malfunction would probably lead to the loss 
of a subsystem. If a malfunction occurred in a mission critical item, the prob- 
ability would be that the mission would be lost. Consideration of the major de- 
grading (criticality 2) defects does not improve this picture. 

Criticality versus Probability of Space Malfunction 

When the causes of the defects are considered, some of the defects will be 
shown to have been caused by some faulty test or checkout activity. These de- 
fects are classified as generated defects. There is also the possibility in any 
test program that some malfunctions will occur in test that would not necessarily 
occur in space. Because of these situations, each defect has been examined for 
its probability of causing a malfunction in space. Figure 5 presents the results 
of this examination. As can be seen, 71 percent of all the defects found in the 
bench test screen had a high probability of causing a malfunction in space. This 
information alone is not enough to describe the situation, however. Another im- 
portant piece of information is how the must critical defects are distributed 
with respect to the probability of causing a space malfunction. If the catastrophic 
defects had a low probability of causing a space malfunction, then the alarm 
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PROBABILITY (%) OF A FLIGHT MALFUNCTION 

Figure 5. Probability that Defects Found in Bench Test Screen 
Would Have Caused a Malfunction in Space 


caused by having a large percentage of catastrophic defects can be relieved. 
Table 2 shows, though, that this is not the case, since 85 percent of the cata- 
strophic and major degrading defects (to subsystems before protection) had a 
high probability of causing a space malfunction. 


Table 2 


Probability of Flight Malfunction vs Criticality of the Malfunctions 
Found in Bench Test Screen (Numbers in table are numbers of defects) 
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Criticality in 
percent loss of 
function 
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90% 

50% 

10 % 

0 % 


100 % 


90% 

50% 

10% 


Probability <%) of a Flight 
Malfunction 


Criticality versus the Sy stematic Nature of Defects 

In a program where several ’’identical" pieces of hardware are going to be 
made , the determination of the systematic nature of the defects can be of some 
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benefit. Non-systematic defects usually affect only one piece of hardware, 
whereas systematic defects affect more than one piece of hardware . Therefore , 
the distribution between systematic and non-systematic defects can indicate the 
extent of the effort needed to correct the defects. Generally, systematic defects 
would take more time, effort, and money to correct than would non-systematic 
defects. The criticality of the systematic and of the non-systematic defects is 
given in Table 3. Given this type of information, and time and dollar constraints, 
a project manager has an overview of how critical the defects are, and how many 
defects could be allowed to fly without repair if necessary. In the case of IMP-I, 
all the non-systematic defects are at least major degrading, but the systematic 
defects are uniformly distributed from negligible to catastrophic. A.I this stage 
of the test program, the bench test screen, this type of information is not as 
important as it would be later in the program . 

Table 3 


Systematic Nature of Defects vs Criticality of Defects 
Found in Bench Test Screen 


to 

oo 

1 

2 

2 

0 

2 

0 


Criticality in percent 
loss of function 


90% - 

100% 

50% - 

90% 

10% - 

50% 

0% - 

10% 
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Causes of Defects 

The causes of the defects detected in the bench test screen are shown in 
Table 4. The causes are presented in five general categories: design , fabrication/ 
assembly, parts /materials, operator error /GSE /handling, and miscellaneous. 
During the analysis, each of these categories has a number of sub-categories. 
For example, design has a packaging and mounting sub-category. Thus, if any 
one sub-category begins to accumulate a large number of defects then this par- 
ticular cause could bp flagged as a matter for attention. The large percentage 
of design defects shown in Table 4 is not surprising for the bench test screen 
since this screen is used to debug the hardware What is somewhat surprising 
is the 12 percent due to parts/materials. This seems to be a high percentage, 
but there are no data from other spacecraft at this level of test which would in- 
dicate the "normal” number of parts /materials defects. 
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Table 4 


Causes of Defects Found in Bench Test Screen 


Design 

41% 

Fabrication/Assembly 

29% 

Parts / Mate rials 

12% 

Operator/GSE /Handl ing 

12% 

Miscellaneous 

6% 


SUBSYSTEM TEST SCREENS 

This section of the report will failure flow analyze each of the subsystem 
test screens individually and also analyze the aggregate of the three screens as 
an overall subsystem test screen. 

Description of Subsystem Test Screens 

The subsystem test screens are shown in Figure 6. These are seen to be 
three individual screens: magnetic/EMI, vibration, and thermal-vacuum. 



Figure 6. Subsystem Test Screens 

1. The magnetic/EMI test screen is a combination of two tests — magnetic 
and electromagnetic interference. These are different from the other 
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environmental screens in that the subsysiem must meet certain magnetic 
and radiation specifications rather than survive a particular environmen- 
tal stress. These tests were run according to the IMP-I test specifica- 
tion for subsystems (ref. 2). 

2. Cards were subjected t.o vibration according to the IMP-I specification 
for subsystems (ref. 2). 

3. Cards were subjected to thermal -vacuum according to Jie IMP-I speci- 
fication for subsystems (ret. 2). 

Performance of the Subsystem Test Screen 

Figure 7 presents the performance of each subsystem test screen in failure 
flow format. The bubble below each screen shows the number of defects in the 
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flow entering that screen. A bubble to the left of a screen gives the number of 
defects, not previously in the flow, that enter the flow at that screen. Thus, 
the total number of defects presented to a screen is the sum of the lower bubble 
and the left bubble. 

The bubble to the right of a screen indicates the number of detections in that 
screen, while the dotted bubble indicates the number of additional times defects 
were detected at the screen before they were diverted. The rectangle to the 
right of each screen shows the number of diversions made at the screen. 

As can be seen in Figure 7, 86 defects were in the flow from the bench test 
screen, nine defects entered the flow during subsystem test, 43 defects were 
diverted, so 52 defects remained in the flow to the system test screen. 

Some special attention should be given to the Magnetic/EMI screen which 
shows only one detection and diversion. As stated earlier, magnetic and EMI 
tests are used to determine if the magnetic and radiative properties are within 
specified limits. Consequently, there are almost never any functional failures 
during these tests, and therefore, no malfunction reports. The fact that there 
were no malfunction reports does not mean that there were no problems or out 
of specification tests. Figure 8 gives the results of the magnetic and EMI tests. 


Number of Tests Number Unsatisfactory Percent Unsatisfactory 


Magnetic 

114 

17 

15% 

EMI 

94 

32 

33% 


Figure 8. Results of Subsystem EMI and Magnetic Tests 


Compared with IMP-F, which was also a protoflight spacecraft, IMP-I had about 
6 percent fewer unsatisfactory magnetic tests . This difference does not seem 
to be significant, so that with respect to magnetic tests IMP-I is about normal. 
There is no significant amount of data with which to compare the EMI test 
results. 

Reasons for Escape from Subsystem Test Screens 

The reasons for escape from each subsystem test screen are given in Fig- 
ures 9, 10, and 11. Figure 9 concerns only the magnetic/EMI screen, Figure 
10 only the vibration screen, and Figure 11 only the thermal -vacuum screen. 
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Figure 9. Diversions ond Reasons for Escape from EMI/ 
Magnetic Subsystem Test Screen 


The vast majority, 87 percent, of the escapes from the magnetic /EMI subsys- 
tem test screen are shown to be in the ineligible category. * 

Figure 10 shows that ineligibility is the primary reason for escape from the 
vibration test screen. This figuie indirectly shows that the subsystem vibration 
test effectiveness is 47 percent, which is not much different from the bench test 
effectiveness of 50 percent. 

Figure 11 shows that more defects are eligible for the thermal-vacuum sub- 
system test screen than for any other subsystem test screen. One reason for 
this is that the thermal-vauum test provides time for a detailed functional check, 
whereas magnetic /EMI and vibration are usually followed by cursory functional 
tests. Since more defects are eligible for this screen, more defects are de- 
tected and diverted in the thermal -vacuum screen than the others, but the test 
effectiveness is 52 percent. 


•If the test effectiveness for this screen is based on the defects reported in the malfunction reports, then the 
effectiveness is only seven percent. However, an examination of the reported defects reveals that each was 
an electromagnetic interference type of defect. With this information the data presented in Figure 8 can 
be used to calculate an effectiveness of 77 percent. This 77 percent effectiveness is probably more repre- 
sentative of the magnetic/EMI screen than the seven percent. 
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Figure 10. Diversions and Reasons for Escape from Vibration 
Subsystem Test So ien 


The fact that the bench test screen, the vibration test screen and the thermal- 
vacuum test screen each have a test effectiveness around 50 percent suggests 
that a 50 percent test effectiveness may be a characteristic test effectiveness 
for subsystem tests. Since this result is based on IMP-I data only, subsystem 
test results from other protoflight programs are needed to substantiate the con- 
clusion. The test effectiveness for the magnetic/EMI screen has been ignored 
while reaching this result because of the different way it is calculated. 

Considering the aggregate of the subsystem test screens, the reasons for 
escape are presented in Figure 12. As would be expected, the dominant reason 
is ineligibility. The overall subsystem test screen effectiveness is 46 percent. 

A more detailed examination of those defects that were ineligible for detec- 
tion at the subystem level yields some interesting information. Sixty percent 
of the defects ineligible for detection at the subsystem level were ineligible be- 
cause they required a higher level of assembly for detection. Put another way, 
10 percent of all the defects that escaped detection during subsystem test es- 
caped because the system level of assembly was necessary to detect them. 
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Criticality of Defects Detected in Subsystem Test Screens 


The one defect detected in the magnetic/EMI screen was catastrophic to the 
subsystem before and after protection, but had a negligible effect on the mis- 
sion before and after protection. 

The criticality of defects found in the subsystem vibration test is presented 
in Table 5. There are more defects in the negligible and minor degrading to 

Table 5 


Vibration Test Screen: Criticality vs Protection 
(Numbers in table are number of defects) 


Criticality 

1 

2 

3 

4 

— 

Subsystem Before Protection 

3 

2 

3 

8 

Subsystem After Protection 

3 

2 

3 

8 

Mission Before Protection 

0 

0 

2 

14 

Mission After Protection 

0 

0 

2 

14 


subsystem categories than in the major degrading and catastrophic categories. 
The defects detected in vibration would have had negligible effect on the mission. 
Protection had no effect on the defects detected in vibration. 

The criticality of the defects detected in the subsystem thermal-vacuum 
test is shown in Table 6. Again there are a few more defects in the minor 

Table 6 


Thermal -Vacuum Screen: Criticality vs Protection 
(Numbers in table are number of defects) 


Criticality 

1 

2 

3 

4 

Subsystem Before Protection 

8 

n 

3 

r 

5 

10 

Subsystem After Protection 

6 

3 

5 

12 

Mission Before Protection 

0 

0 

0 

26 

Mission After Protection 

0 

0 

0 

26 
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criticality to subsystem categories than in the major criticality categories. 
Every defect was in the negligible to mission category. Protection reduces the 
criticaiiiy to subsystem fur only iwu uf Liie eigne catastrophic defects, and has 
no effect on any other defects. 

Table 7 presents the criticality analysis for the overall subsystem test 
screen. The same comments can be made about the aggregate as were made 

Table 7 


Subsystem Test Screen: Criticality vs Protection 
(Numbers in table are number of defects) 


Criticality 

1 

2 

3 

4 

Subsystem Before Protection 

12 

5 

8 

18 

Subsystem After Protection 

10 

5 

8 

20 

Mission Before Protection 

0 

0 

2 

41 

Mission After Protection 

0 

0 

2 
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about the individual screens. An interesting observation is the comparison be- 
tween the criticality of the defects found in the bench test screen and the criti- 
cality of the defects found in the subsystem test screen. Most of the defects 
found in the bench test were in the catastrophic to subsystem category, but for 
the subsystem screen there were more defects in the minor criticality categor- 
ies than the major. 

In both the bench test screen and the subsystem test screen the criticality 
of defects is affected very little by protection. 

Criticality versus Probability of Space Malfunction 


Table 8 presents the distribution of defects detected in the subsystem tests 
according to their probability of causing a space malfunction. As can be seen, 
most of the defects would have resulted in a flight malfunction if they had not 
been diverted during the test program. 

The distribution of defects according to criticality and probability of causing 
a space malfunction is shown in Table 9. Note that all of the catastrophic and 
major degrading defects had a high probability of causing a problem in space. 























Table 8 


Probability that Defects Found in Subsystem Test Screens 
Would Have Caused a Malfunction in Space 
(Numbers in table are number of defects) 


V ibration 

1 

4 

11 

Thermal -V acuum 

8 

4 

14 

Total Subsystem 

9 

8 

26 
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20-80 

80-100 


Probability (7o) of a Flight Malfunction 


Table 9 

Probability of Flight Malfunction vs Criticality of the Malfunctions 
Found in Vibration Subsystem Test Screen 
(Numbers in table are numbers of defects) 


1 

3 2 

O 

u 3 

o 

4 


Probability (%) of a Flight Malfunction 

Table 10 gives the same data for the subsystem thermal-vacuum test. Al- 
though most of the catastrophic and major degrading defects were likely to have 
caused a space malfunction, there were a few that were det cted during test 
that had a low probability of causing a space malfunction. 

The data for the overall subsystem test screen is shown in Table 11. These 
data all indicate that the defects detected during subsystem test were "real" de- 
fects that would have caused malfunctions later, and did not result from the 
amount or severity of testing. 
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Table 10 


Probability of Flight Malfunction v s Criticality of the Malfunctions 
Found in Thermal-Vacuum Subsystem Test Screen 
(Numbers in table are number of defects) 
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2 

2 

4 

2 

1 

0 

2 
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1 

3 

4 

4 

1 
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0-20 

20-80 
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Probability (%) of a Flight Malfunction 


Table 11 


Probability of Flight Malfunction vs Criticality of the Malfunctions 
Found in the Subsystem Test Screens 
(Numbers in table are number of defects) 
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2 

8 

o 

imi 
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1 

3 

3 
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4 

4 

4 

10 
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20-80 

80-100 


Probability (%) of a Flight Malfunction 


Criticality versus the Systematic Nature of Defects 


The systematic nature of defects detected in the subsystem test screens is 
presented in Figure 13. As was the case for the bench test screen, there are 
more non-systematic than systematic defects. The distribution between system- 
atic and non-systematic defects is shown to be approximately the same for both 
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Figure 13. Breakdown of Systematic and Non-Systematic 
Defects Found in the Subsystem Test Screens 

the vibration test and the thermal -vacuum test. Table 12 gives the distribution 
of systematic and non -systematic defects detected during subsystem test according 

Table 12 


Systematic Nature of Defects vs Criticality of Defects Found in 
Subsystem Test Screen (Numbers in table are number of defects) 



Systematic Non-Systematic 


to criticality. The systematic defects are distributed according to criticality 
in about the same way as the systematic defects detected in the bench test 
screen. There were proportionally fewer major criticality non -systematic de- 
fects during sysbystem test than during bench test. 
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An interesting sidelight here is the determination of the screen effectiveness 
for systematic defects only. These data are presented in Table 13. Because the 
screen effectiveness for all defects is 46 percent, the subsystem test screens 
are 10 to 15 percent more effective for systematic defects. 

Tabic 13 


Subsystem Test Screen Effectiveness for 
Systematic Defects 



Possible to 
Detect 

Detected & 
Diverted 

Effectiveness 

Vibration 

27 

16 

60% 

Thermal -Vacuum 

43 

26 

60% 

Overall 

77 

43 

56% 


Causes of Defects 

The causes of the defects found in the subsystem vibration test screen are 
presented in Figure 14. There are two significant differences between the 
causes of the defects detected in vibration and those detected in bench test. 
First, the relative percentages for design and for fabrication are switched from 
the bench test results. This is not surprising, as the vibration test is usually 
a good screen for workmanship type defects. Second, the percentage of parts/ 
materials defects has doubled. There does not seem to be an immediate ex- 
planation for this. 

Figure 15 presents the same type of data for the thermal-vacuum test 
screen. Again, there are more fabrication caused defects than design defects, 
but the number of part /materials defects is the same as in bench test. 

Figure 16 gives the cause data for the aggregate subsystem test screen. 
There is a higher percentage of fabrication defects than design defects, which is 
different from bench test, and the percentage of parts /materials problems is 
slightly higher than for bench test. 

Environmental Sensitivity of Defects 

Figure 17 depicts the percent of the defects detected in each environ- 
ment that were determined to have been sensitive to that environment. 

Nearly all of the defects detected in vibration and EMI tests were sensitive to 
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Figure 15. Causes of Defects round in Thermal-Vacuum Subsystem Test Screen 
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Figure 16. Causes of Defects Found in Subsystem Test Screens 



Figure 17. Environmental Sensitivity of Defects Found in 
Each Subsystem Test Screen 
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the particular environment, but less than half of the defects found in thermal- 
vacuum were sensitive to that environment. There are two possible explanations 
for this. First, the malfunction may have been caused by vibration, but not 
detected until thermal -vacuum. This is a possibility because of the lack of a 
comprehensive functional check between vibration test and thermal -vacuum. 
Second, the defects could have been eligible for, and escaped the bench test. 


SYSTEM TEST SCREENS 
Description of System Test Screens 


The system test screens are shown in Figure 18. System tests include all 
tests performed on the integrated or partially integrated spacecraft, including 
the environomental tests according to the IMP-I specifications, (ref. 3 and 
ref. 4). There are 17 system test screens: (1) integration; (2) sun spin/ 
magnetic; (3) EMI; (4) temperature; (5) mass properties; (6) ACS deployment; 

(7) reintegration; (8) vibration /shock; (9) spin deployment; (10) reintegration/ 
EMI; (11) thermal-vacuum; (12) solar simulation setup/SES failure/solar 
simulation; (13) short vacuum tests one and two; (14) short thermal-vacuum; 

(15) reintegration; (16) vibration; (17) final and ETR checkout. 

1. The integration screen includes all the integration and test activities of 
spacecraft up to May 25, 1970. This is the period when the spacecraft 
was put together for the first time, and a functional checkout of the en- 
tire spacecraft system could be accomplished. 

2. The sun spin/magnetic screen is a combination of two tests. The sun 
spin test checked out the optical aspect system. The magnetic test de- 
termined the magnetic properties of the spacecraft. This screen covers 
the period from May 25, 1970 to May 26, 1970. 

3. This screen is the EMI test of the entire spacecraft. It covers the 
period from June 4, 1970 to June 11, 1970. 

4. The temperature test screen is the week long temperature only test of 
the spacecraft. It covers the period from June 12, 1970 to June 19, 

1970. 

5. The mass properties screen is not really a. test screen, but is included 
as a screen because the measurement of the mass properties occurred 
during the test program. Such properties as weight, center of gravity, 
and balance are measured, and these measurements are the reference 
measurements until launch. This screen covers the period from July 28, 
1970 to August 5, 1970. 
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6. The attitude control system (ACS) deployment test was done between 
August 6, 1970 and August 18, 1970. This test checked the deployment 
of the ACS booms. 

7. Between August 19, 1970 and September 24, 1970 the spacecraft was 
partially disassembled and then reassembled. This period of activity 
is the reintegration test screen. 

8. The vibration and shock tests were run between September 25, 1970 and 
September 30, 1970. The spacecraft received three axis sine and ran- 
dom vibration at protoflight levels according to the IMP -I specification, 
and a pyrotechnic shock test. 

9. A series of spin deployment tests were run between October 2, 1970 
and October 20, 1970. This screen was to test the various boom de- 
ployment mechanisms under conditions of underspin and overspin as 
well as normal spin. The tests were performed in the dynamic test 
chamber (DTC). 

10. The period from October 21, 1970 to October 31, 1970 was another re- 
integration period. An EMI test was performed, and the spacecraft was 
setup for the thermal -vacuum test. 

11. The thermal -vacuum test was performed between November 2, 1970 
and November 14, 1970. Protoflight levels were used according to the 
IMP-I test specification. 

12. The period of November 14, 1970 to December 20, 1970 has three parts 
that make up this screen. The first part is the preparation of the space- 
craft and the test facility for the solar simulation test. The second part 
is the failure of the spacecraft positioner in the space environment sim- 
ulator. While the positioner was being repaired, there was some dis- 
assembly and reassembly of the spacecraft and some functional checkout. 
The third part is the solar simulation test. 

13. Due to a problem in the encoder that was thought to be vacuum caused, 
two short vacuum tests were run between December 21, 1970 and 
January 8, 1971. 

14. A short thermal-vacuum test was performed at protoflight levels be- 
tween January 11, 1970 and January 14, 1970. 

j 

15. This screen is another reintegration period between January 18, 1971 
and January 27, 1971. Another mass properties measurement was also 
done during this time. 
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16. A vibration test was run between January 28, 1971 and February 1, 

1971. 

17. This screen includes the final magnetic measurements, sun spin test, 
shipment to ETR, and checkout at ETR. It covers the period from 
February 3, 1971 to February 15, 1971. 

Performance of the System Test Screens 

Figure 19 presents the performance of each system test screen in failure 
flow format. As can be seen in Figure 19, a number of screens did not detect 
any defects. The reason for this is that most of the defects were not eligible 
for these screens. The screens with no detections have been included to pre- 
serve continuity of the test program. They have not been combined with other 
screens so that they would not confuse the screening activity of the other screens . 

The remaining paragraphs of this section will not analyse every screen, as 
was done in the subsystem test screen section, but will concentrate on the more 
important screens. 

Reasons for Escape from System Test Screens 

The reasons for escape from eleven system test screens are presented in 
Table 14. The escapes attributed to some inadequacy range from seven percent 
in system thermal -vacuum test to 35 percent in system temperature. With the 
exception of the thermal -vacuum test, those screens that entail a thorough func- 
tional test such as the reintegration screens , have the largest percentages in 
the inadequate category. These same screens, including thermal -vacuum, also 
have the highest detection percentages. 

The comparison of similar screens at the system level and the subsystem 
level is of some interest. The system EMI test had 25 percent of its escapes 
due to inadequacy, and the subystems EMI test had only 12 percent. The sys- 
tem vibration test had 17 percent escapes due to inadequacy, and the subsystem 
test had 16 percent. There were seven percent inadequate escapes for the sys- 
tem thermal -vacuum test, but 27 percent for the subsystem thermal-vacuum 
test. 


There does not seem to be any correlation between reasons for escape 
from these particular system screens and the corresponding subsystem screens. 
However, Figure 20 presents the summary of the reasons for escape from the 
system test screens. Comparing this with Figure 12, the reasons for escape 
from subsystem screens and from the system screens, when all the screens are 
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Figure 19 . Peifornwp.ee of System Test Screens in Failure 
Flow Format (Continued) 
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Table 14 


Reasons for Escape from Eleven System Test Screens 



— 

Ineligible 

Inadequate 

Diverted 

Integration 

50% 

29% 

21% 

EMI 

71 

or 

60 

4 

Temperature 

55 

35 

10 

Reintegration 

60 

22 

18 

Vibration 

78 

17 

5 

Spin Deployment 

77 

14 

9 

Reintegration/E MI 

66 

25 

9 

Thermal-V acuum 

41 

r» 

52 

Solar Simulation 

q a 

KJ KJ 

rr 

1 

57 

Final Vibration 

83 

17 

0 

Final ETR 

1 

83 



-i n 

ll 

0 


considered, are distributed almost identically at> important note here is that 
49% of all the defects detected in the system test screens required the system 
level for detection. 

Table 15 gives the screen effectiveness for the screens in Table 14, The 
effectiveness stays between 13 percent and 44 percent until the thermal-vacuum 
screen is reached, where the effectiveness jumps to 88 percent. Despite the 
low effectiveness for some of the screens, the overall system test screen effec- 
tiveness is 92 percent. This is considerably higher than the 50 percent subsys- 
tem screen effectiveness. 

Criticality of Defects Detected in System Test Screens 

The criticality to the subsystem, before protection, of the defects found in 
the system test is presented in Tabic 16. .Some 42 percent of the defects are in 
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Figure 20. Summary of Diversions and Reasons for Escape from 
System Test Screens 

the major degrading or catastrophic categories. Forty percent of the defects 
detected by tne subsystem screens were in these categories, so that the criti- 
cality of defects found in the system test screens is almost the same as the 
criticality of the defects detected during subsystem test. One fact that needs 
to be noticed here is the large number of catastrophic and major degrading de- 
fects that have escaped as far downstream as the thermal -vacuum Lest. 

Table 17 shows the mission criticality of defects detected during system 
test. There are relatively few mission catastrophic or major degrading defects, 
and these are caugnt eariy in Hie system test screens. 

The effects of protection on subsystem criticality are illustrated by the 
matrix in Table 18. The rows give the criticality before protection and the col- 
umns give the criticality after protection. The numbers along the diagonal in- 
dicate those defects that were not affected by protection; the numbers above the 
diagonal indicate the defects whose criticality was reduced by protection; and 
the numbers below the diagonal indicate the defects whose criticality was in- 
creased by protection. An example of how criticality would be increased by 
protection would bo an experiment that generates enough noise to affect several 
other experiments, but does not affect itself. The protection for the other ex- 
periments is to turn the noisy experiment, off. which makes the defect catas- 
trophic ! As has been the case with the bench test screen and the subsystem test 
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Table 15 


Screen Effectiveness for Eleven System Test Screens 


Integration 

42% 

EMI 

13 

Temperature 

18 

Reintegration 

44 

Vibration 

25 

Spin Deployment 

37 

Reintegration/E MI 

27 

Thermal -V acuum 

88 

Solar Simulation 

89 

Final Vibration * 

— 

Final/E TR 1 

— 


*NOTE: No defects eligible for these two 
screens, therefore effectiveness is undefined. 


screens , there is very little protection for the defects found in the system test 
screens. Table 19 is a similar treatment of the effects of protection on mission 
criticality. As usual, there is little effect of protection. 

The last factor to bo considered in this section is the proneness of the de- 
fects detected in system test to cause a space malfunction if they were not de- 
tected. The data for this consideration are presented in Table 20. As can be 
seen, most of the more critical defects could have caused a space malfunction 
if they had not been detected in test. 

Criticality Versus the Systematic Nature of Defects 


The distribution between systematic and non-systematic defects is shown 
in Figure 21. There are nearly equal numbers of each, which is different from 
the subsystem screens where there were more non-systematic defects. The 
bench test screen results were midway between the subsystem and system 
results. 
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Table 16 


Subsystem Criticality (Before Protection) of Defects Found in 
System Test Screens (Numbers in table are numbers of defects) 


Integration 

6 

2 

2 

4 

EMI 

0 

1 

0 

1 

Temperature 

2 

0 

1 

1 

Reintegration 

0 

3 

o 

5 

Vibration 

0 

1 

1 

0 

Spin Deployment 

1 

0 

0 

2 

Reintegration/E MI 

1 

1 

1 


Thermal-Vacuum 

3 

3 

2 

1 7 

Solar Simulation 

0 

1 

3 



1 

2 

3 

4 


Criticality 


Table 17 


Mission Criticality (Before Protection) of Defects Found in 
System Test Screens (Numbers in table are number of defects) 


Integration 

3 

1 
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10 
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Temperature 
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Vibration 
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Spin Deployment 
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Table 18 


Effects of Protection on Subsystem Criticality 
(Numbers in table are numbers of defects) 



12 3 4 


AFTER 


Table 19 

Effects of Protection on Mission Criticality 
(Numbers in table are numbers of defects) 



12 3 4 

AFTER 


The systematic defects detected in system test sere ms were equally divided 
between major degrading and minor degrading criticality. The subsystem test 
screens had almost twice as many systematic defects of mine ' degrading criti- 
cality as major degrading criticality. The bench test screen was the same as 
the system test screen in that the systematic defects were uniformly distributed 
over criticality - 
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Table 20 


Probability of Flight Malfunction vs Criticality of the Malfunctions 
Found in the System Test Screens (Numbers in table are number of defects) 
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Figure 21 . Distribution of Systematic and 
Non-Systematic Defects Found 
in the System Test Screens 

The screen effectiveness for systematic defects for nine system screens is 
given in Table 21. Thermal -vacuum has a systematic defect effectiveness equal 
to the subsystem thermal -vacuum test, but system vibration test is not as effec- 
tive as subsystem vibration. The overall system screen effectiveness for sys- 
tematic defects is 89 percent, which is considerably better than the subsystem 
screen. Since the effectiveness of the system screens tor any kind of defect is 
92 percent, the screen effectiveness for systematic and non-systematic defects 
is about the same. 

Cause s of D efects 

The causes of the defects found in the system screens are presented in 
Figure 22. Design is the major cause, with fabrication second, and 
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Table 21 


System Test Screen Effectiveness for Systematic Defects 



Possible 
to Detect 

Detected & 
Diverted 

Effectiveness 

Integration 

19 

8 

42% 

EMI 

8 

0 

0% 

Temperature 

16 

3 

19% 

Reintegration 

13 

5 

38% 

Vibration 

6 

O 

33% 

Spin Deployment 

5 

1 

20% 

Reintegration/E MI 

7 

o 

29% 

Thermal -V acuum 

8 

6 

63% 

Solar Simulation 

3 

2 



67% 


parts /material third. These results are almost identical to the bench test 
screen results, but are quite different from the subsystem screen results 
(Figure 14). The large percentage of design defects could be a result of the 
protoflight concept. 

Environmental Sensitivity of Defects 

Figure 23 gives the percentage of the defects found in an environmental 
screen that were sensitive to that environment. Note that only 40 percent of the 
defects found in thermal -vacuum were precipitated by the thermal -vacuum en- 
vironment. All of the defects found in the solar simulation screen were found 
before the test actually began, so none were susceptible to Lao environment. 
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Figure 22. Causes of Defects Found in System Test Screens 
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SPACE PERFORMANCE 


Description of Malfunctions in Space 


There were seven malfunctions in space that were used for this failure flow 
analysis. 

1. Following the boom deployment sequence, the -Y axis ACS ooom was 
indicated as not being locked. Since the spacecraft was successfully 
despun, the micro-switch used to indicate lock is the prime suspect. 

2. Eight days after turn-on, the main telescope of the University of Chicago 
experiment failed causing a major loss of data. An open circuit in a 
painted stripe connection to the detector is the prime suspect. 

3. The spacecraft does not respond as planned to the attitude control sys- 
tem. Since the ACS is working properly, this is either a dynamics 
proolem or a computational problem, rather than a failure. 

4. The --X antenna motor failed after the antenna had been extended to 78 
feet out of a planned 12C feet. These motors had been a problem during 
the entire program. 

5. Dr. MacDonald's Very Low Energy Detector was damaged by radiation 
and was turned off. 

6. Dr. Erikson's Impedance Probe failed after its objectives had been 
achieved. A stuck relay is suspected. 

7. Dr. Ogilvie's experiment is inooerative. A high voltage problem due to 
outgassing of a void in potting . suspected. 

In addition to these seven malfunctions there are four anomalies that have 
not been used because there is not enough information or because the anomaly is 
no real problem. 

1. The on-board computer had some cases of "lapse of memory. " It is a 
hardware problem, but it can be overcome with a software change. 

There was not enough information to do the failure flow ar?lysis of this 
problem. 

2. There were a few cases of the right command being Lor.t, but the wrong 
action taking place. This has not been a recurring problem, and there 
is no explanation as to why it ever occurred. 
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3. Dr. Cline’s experiment was planned to be turned off and on as the space- 
craft entered and exited the radiation belt. During the twelfth orbit it 
failed to respond to an ON command, but about a month later it did res- 
pond. No cause is known, but the experiment will be left on to avoid the 
problem. 

4. One of the solar panels was suspected to be inoperative, but this was 
later found to have been the result of a shadow. 

Discussion of the Space Malfunctions 


Of the seven malfunctions , one was a likely candidate for detection during 
test, one was a problem through the whole program, two can almost be classi- 
fied as random failures , two could not have been detected in test and cne prob- 
ably could not have been detected in test. 

1. The University of Chicago experiment that failed was not in the space- 
craft for either thermal -vacuum or solar simulation. An identical ex- 
periment failed after solar simulation, for a different reason, and was 
replaced by the experiment that ultimately failed in space. 

2. The antenna motors had problems throughout the whole program, some 
of which were similar to the space failure. These were usually wear 
problems, so the flight motors were exercised as little as possible dur- 
ing test. 

3. The ACS boom micro-switch failure could have been a random failure, 
or it could have been damaged. 

4. There are a number of relays used to step Dr. Erikson’s experiment 
through a series of measurements. All of the relays up to the failed 
relay are still operative , so a random tailure seems more likely than 
wear out. 

5. The dynamics problem could not have been detected in test. 

6. The damage to the Very Low Energy Detector could not have been de- 
tected in test, since it was an unusual environment that caused the failure. 

7. The time tc outgas the suspected void in Dr. Ogiivie’s experiment was 
longer (800 hrs. vs. 312 hrs.) than any thermal -vacuum test and prob- 
ably could not have been detected in test. 


40 



Eighty-six percent of the defects were catastrophic to subsystems before 
protection; 14 percent were negligible. Seventy-one percent were catastrophic 
after protection. Fourteen percent were major degrading to the mission before 
protection, but none were more than negligible after protection. (If the three 
problems for which there are no explanations are included, then 60 percent of 
the defects were catastrophic to subsystems before protection, and 50% were 
still catastrophic after protection. ) 

Forty-three percent of the defects that caused malfunctions in space were 
systematic defects. Design is the major cause of defects, with parts /materials 
a close second. 

Twenty -nine percent of the defects appear to be sensitive to the space 
environment. 


SUMMARY AND INTERPRETATION 

This section consists of two parts. The first part summarizes the data 
gathered by using failure flow analysis. The second part interprets the data in 
a way that an evaluation of the test program is produced. 

Summary of Data 


The entire screen system from bench test to space is presented in failure 
flow format in Figure 24. This first part presents the significant data from 
each of the four data sections of the report - bench test screen, subsystem te,?t 
screen, system test screens, and space performance. 

1. Bench Test Screen 

• Ineligibility for detection is the major reason for escape 

• The screen was 50% effective, but this is somewhat uncertain 

• Two-thirds of the defects detected were catastrophic to subsystems 
before protection 

• One -eighth of the defects detected were at least major degrading to 
the mission before protection 

• Protection did little to change criticality 
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Figure 24A. IMP-1 Screen Performance in Failure Flow Format 
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Figure 24B. IMP-1 Screen Performance in Failure Flow Format (Continued) 
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Figure 24C. !MP-! Screen Performance in Failure Flow Format (Continued) 


• Eighty -five percent of the defects would have caused a malfunction in 
space 

• Systematic defects were evenly distributed in criticality 

• Design was the major cause of defects 

• The percentage of parts /materials defects seemed high 


44 
















2. Subsystem Test Screen 

• Ineligibility is the major reason for escape 

• The screen was 46 percent effective 

• There were more minor criticality to subsystem before protection 
defects than major 

• Protection had little effect on criticality 

• The major criticality defects had a high probability of causing a 
space malfunction 

• Systematic defects were evenly distributed in criticality 

• Fabrication/assembly was the major cause 

• The percentage of parts /'materials caused defects was higher than in 
bench test 

• Most of the defects detected in vibration were sensitive to the vibra- 
tion environment 

• Less than half of the defects detected in thermal-vacuum were sensi- 
tive to the thermal -vacuum environment 

3. System Test Screen 

• Screens with the most comprehensive functional checkout had the 
highest percentage of escapes due to inadequacy, but also had the 
highest detection rate 

• Ineligibility is the major reason for escape 

9 The screen was 92 percent effective 

• F orb/ -two percent of the defects were at least major degrading to 
subsystems before protection 

• There were very few mission critical defects detected during system 
test 
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• Protection had little effect on criticality 

• Most of the defects had a high probability of causing a space 
malfunction 

• Systematic defects were evenly distributed in criticality 

• Design was the major cause of defects; fabrication/assembly was 
the second most prevalent cause; parts /materials was third 

• All of the defects detected in vibration were sensitive to the vibration 
environment, but only forty percent of the defects del acted in thermal- 
vacuum were sensitive to thermal-vacuum 

4. Space 

• There were seven malfunctions in space 

• Ineligibility was the major reason for escape to space 

• Sixty percent were catastrophic to subsystems before protection 

• Fifty percent were catastrophic after protection 

• Design was the major cause; parts /materials was second 
Interpretation of the Data 


This second part interprets the data presented in the first part, indicates 
some cautions and improvements with respect to a test program, and shows 
some of the useful features of failure flow analysis. 

• Ineligibility is consistently the major reason for escape on a screen 
by screen basis. Considering each of the screen systems - bench, 
subsystem, and system - separately, this is reasonable. Most of the 
screens are designed to detect particular kinds of defects. A defect 
is ineligible for detection if it is a different kind of defect from the 
kind for which the screen was designed. 

• However, those defects that escape into space because of ineligibility 
for detection present an opportunity to improve the screen system . 
Those defects that were ineligible because there was no screen for 
that defect, or because they did not pass through the screen, indicate 
the need for a specific screen. In the case of IMP -I, a second long 
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thermal-vacuum test, rather than the short thermal -vacuum test, 
may have detected some of the defects that escaped to space. 

• The overall screen was 94 percent effective. If the system test 
screen effectiveness is constant, then it presents a way to assess 
the risk involved in eliminating or curtailing the subsystem test 
program. 

• The percentage of defects that were catastrophic or major degrading 
to subsystems, before protection, in space was somewhat higher 
than it had been during test screens, 60 percent versus 46 percent. 

If the 46 percent had been used to predict the percent of the space 
malfunctions that would be at least major degrading, 60 percent would 
have been a fairly close result. 

• The effect of protection could have been very accurately predicted, 
since only one of the major degrading defects in space has its criti- 
cality reduced by protection. 

• The percentage of systematic defects in space, 43 percent, is not far 
from the 53 percent detected in system test. In fact, if the 37 per- 
cent systematic defects detected in subsystem test is also considered, 
43 percent is close to the average of subsystem and system screens. 

• The distribution of cause of defects in space is quite interesting. The 
major cause of defects detected in system screens was design, with 
fabrication second. The major cause of defects detected in subsystem 
screens was fabrication, with design second. Parts /Materials was 
the third most prevalent cause for both system and subsystem detec - 
tions. The fact that design accounts for three of the seven space 
malfunctions is not surprising. What is somewhat surprising at first 
is that parts failures accounted for two of the seven space malfunc- 
tions. The concern expressed earlier in this report, that 15 to 25 
percent defects caused by parts /materials was a high percentage, is 
justified by this result. This does not determine what a good percen- 
tage is, only that 15 to 25 percent is high. The low fraction of space 
malfunctions due to fabrication defects, one out of seven, is not in 
accord with the results during test. However, this could indicate 
that the protoflight test program has the capability to remove almost 
all of the fabrication defects from the flow. This particular question , 
whether defects were detected because of the protoflight levels , was 
asked during the analysis, but the question is almost impossible to 
answer on a defect by defect basis. In the case of IMP-I, though, 
there were very few fabrication defect-caused malfunctions in space, 
and this could be a result of the protoflight levels. 
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• One space malfunction, the University of Chicago experiment, could 
have been damaged during launch, and then degraded by the space 
thermal -vacuum environment until it failed. The effect of the launch 
environment is a weak conjecture though. Dr. Ogilvie's experiment’s 
failure can be attributed to the space vacuum, if the analysis of the 
failure is correct. This means that 30 percent of the space malfunc- 
tions were possibly caused by the thermal-vacuum environment. How- 
ever, one of the defects never underwent system test, and it is doubt- 
ful that the other should have been detected. These data Indicate that 
all the environmentally sensitive defects that could have been found 
during test were found . Had there been a second long thermal -vacuum 
test, the two environmentally sensitive space malfunctions might pos- 
sibly have been found. 

There is some information developed in this report which can only be devel- 
oped by failure flow analysis, and some information that could be developed by 
other means but is integrated into a unified picture by failure flow analysis. 

• Failure flow analysis showed what kinds of defects were removed at 
any point in the test program. It showed that a number of major de- 
grading defects that should have been detected earlier were detected 
far downstream in system thermal -vacuum test. If each screen has 
a characteristic effectiveness, which is an assumption at this point, 
then loading a downstream screen increases the probability of an 
escape, and consequently a space malfunction. 

• Failure flow analysis shows that not only does the system thermal- 
vacuum screen detect the most defects, but it is also the most effec- 
tive screen. This means that the system thermal -vacuum screen 
detects a higher percentage of the defects eligible for detection than 
any other screen . 

• This study has confirmed the need for very thorough parts screening 
for protoflight programs. 

• The area of test that could be improved to decrease the downstream 
loading by at least fiO percent is the functional test. Only 40 percent 
of the defects needed thermal -vacuum for detection, and none needed 
solar simulation. 

In light of future programs that will have extensive subsystem tests before 
system test, or programs that will be limited to less than full system tests be- 
cause of size, failure flow analysis has provided some vaulable information. 
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? The 3 ubsyn*em test program as performed for IMP -I was only 30 per - 
cent effective for eligible defects, and this does not include defects 
that required the system level for detection. This must be improved 
before the subsystem test screens alone can be used to assure reliable 
spacecraft. 

• Considering the environmental sensitivity of defects detected in sub- 
system screens, failure flow analysis indicates that the most improve- 
ment can be made in the areas of functional tests and parts screening. 

• Coupled with the low effectiveness of the subsv«t*»_r test screen is the 
fact that nearly 50 % of the defects detected during system test required 
the system level of assembly for detection. Before any project is 
started that would involve a spacecraft too large for system test, two 
things must be changed. First, the subsystem test program must be 
made more effective. Second, the number of defects f hat require the 
system level for detection must bo reduced. 

Failure flow analysis would have the most value if it were used on a real 
time basis. It gives a view of how many and what kinds of problems are occur- 
ring, and thus could lead to early elimination of some sources of defects. Fail- 
ure flow analysis could give an estimate of flight readiness, and indicate what 
actions might achieve flight readiness in the most efficient way. 
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